Skip to main content
rightsizing · snowflake

Snowflake tables paying for search optimization with fewer than 10 point lookups

resource types
1
rule IDs covered
1
severity
low

What does ZopNight detect here?

ZopNight flags a Snowflake table that spent search optimization credits over the last 30 days while serving fewer than 10 point-lookup queries. The search optimization service bills to build and maintain its access path, which pays back only on selective lookups, so `ALTER TABLE ... DROP SEARCH OPTIMIZATION` removes a cost with almost no users.

Signal and threshold

How ZopNight evaluates Snowflake tables paying for search optimization with fewer than 10 point lookups.
Field Value
Rule IDsRC-2114
Categoryrightsizing
Severitylow
Metricsearch optimization credits and point lookups
Threshold> 0 credits and < 10 lookups
Evaluation window30d
SourceZopNight
Permissions usedSNOWFLAKE.USAGE_VIEWER

An access path you pay to build and keep current

The search optimization service, an Enterprise Edition feature, speeds up selective point lookups that return one or a few rows, and several other query shapes. According to Snowflake’s cost estimation page, it costs in two ways: a search access path that typically takes about a quarter of the table’s size in storage, and compute to build it and then maintain it as data changes, billed per second. High-churn tables cost the most to maintain.

If almost nobody runs the lookups it was added for, both costs continue with nothing to show for them.

Credits per table, and a caution on column names

SEARCH_OPTIMIZATION_HISTORY records maintenance credits:

Terminal window
SELECT database_name, schema_name, table_name,
SUM(credits_used) AS sos_credits_30d
FROM SNOWFLAKE.ACCOUNT_USAGE.SEARCH_OPTIMIZATION_HISTORY
WHERE start_time >= DATEADD('day', -30, CURRENT_TIMESTAMP())
GROUP BY 1, 2, 3
HAVING SUM(credits_used) > 0
ORDER BY sos_credits_30d DESC;

Snowflake is replacing TABLE_NAME in this view with BASE_TABLE_NAME and INDEX_NAME; if your account has the new columns, group by base_table_name instead. SHOW TABLES reports search_optimization (ON or OFF) and search_optimization_bytes for each table.

Credits spent, fewer than 10 point lookups

ZopNight sums the table’s search optimization credits over 30 days and needs a total above zero, then sums the point-lookup queries against the table in the same window and fires when there were fewer than 10. Other query shapes the service can help, such as substring or geospatial searches, are not counted, which is the main source of false positives.

Tables the check passes over

Missing or empty credit or lookup series mean nothing is raised. Ten or more point lookups in 30 days clears the table. And because the finding is priced, it is not shown when ZopNight has no credit rate for the account.

The saving covers compute only

The saving is the table’s search optimization credits, valued at the per-credit rate for the account’s edition, or the Enterprise rate when the edition is unknown:

Terminal window
saving per month = search optimization credits over 30 days x credit rate for the edition

The storage used by the search access path is not in that figure, so dropping the service recovers somewhat more than shown.

Dropping search optimization

  1. Confirm which queries used it. If they are substring, text or geospatial searches rather than point lookups, the finding may not apply.
  2. Remove it from the whole table: ALTER TABLE crm.customers DROP SEARCH OPTIMIZATION; or from specific columns with the ON clause.

See it fire on your bill.

Connect an account read-only in about five minutes. Findings start with the first scan.

472 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

472 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·